CVE request: arbitrary code exec in bcfg2

[Vincent Danen <vdanen () redhat com>]

bcfg2 suffers from an arbitrary code execution flaw due to the Trigger
plugin.  Upstream has corrected the issue in git, but no released
packages are available and it looks like this has been around for a
while (indicated that 1.x is affected as well, up to and including the
current 1.2.2 release).

Looks like an authenticated remote root compromise (need to be able to
log into bcfg2 to exploit it, and bcfg2 typically runs as root).

Could a CVE be assigned to this please?

References:

http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539
http://trac.mcs.anl.gov/projects/bcfg2/changeset/a524967e8d5c4c22e49cd619aed20c87a316c0be
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=679272
https://bugzilla.redhat.com/show_bug.cgi?id=835985

Thanks.

--
Vincent Danen / Red Hat Security Response Team